1940719 - Assertion failure: aValue <= (size_t(1) << (sizeof(size_t) * 8 - 1)) (can't round up -- will overflow!), at mozilla/MathAlgorithms.h:362

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 20250109-6da2f152d57b (debug build, run with --fuzzing-safe --ion-offthread-compile=off):

{
    a = 1 << 28;
    b = a;
    c = 8;
    const d = b / c;
    e = 6;
    let f = [];
    for (let g = 0; g < d; g++) f[g] = g;
    for (g = b - e;;) f[g] = g;
}

Backtrace:

received signal SIGSEGV, Segmentation fault.
#0  0x5881bc67 in js::gc::BufferAllocator::alloc(unsigned int, bool) ()
#1  0x5881cea3 in js::gc::BufferAllocator::realloc(void*, unsigned int, bool) ()
#2  0x588bb77e in js::Nursery::reallocateBuffer(JS::Zone*, js::gc::Cell*, void*, unsigned int, unsigned int) ()
#3  0x581d538d in js::HeapSlot* js::ReallocateCellBuffer<js::HeapSlot>(JSContext*, js::gc::Cell*, js::HeapSlot*, unsigned int, unsigned int) ()
#4  0x581d604f in js::NativeObject::growElements(JSContext*, unsigned int) ()
#5  0x57f8c24a in js::NativeObject::extendDenseElements(JSContext*, unsigned int, unsigned int) ()
#6  0x57f8bdc6 in js::NativeObject::ensureDenseElements(JSContext*, unsigned int, unsigned int) ()
#7  0x581dcbaf in bool AddOrChangeProperty<(IsAddOrChange)0>(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::PropertyDescriptor>, js::PropertyResult*) ()
#8  0x581e1894 in bool js::NativeSetProperty<(js::QualifiedBool)1>(JSContext*, JS::Handle<js::NativeObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) ()
#9  0x57ed384c in js::SetProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::PropertyKey>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::ObjectOpResult&) ()
#10 0x57f483c8 in js::SetObjectElementWithReceiver(JSContext*, JS::Handle<JSObject*>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>, bool) ()
#11 0x589fe7f7 in js::jit::DoSetElemFallback(JSContext*, js::jit::BaselineFrame*, js::jit::ICFallbackStub*, JS::Value*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, JS::Handle<JS::Value>) ()
#12 0xe81f2084 in ?? ()
#13 0xe822ae84 in ?? ()
#14 0xe81ea7ed in ?? ()
#15 0x58c22884 in js::jit::EnterBaselineInterpreterAtBranch(JSContext*, js::InterpreterFrame*, unsigned char*) ()
#16 0x57f2696e in js::Interpret(JSContext*, js::RunState&) ()
[...]
#26 0x57d8c780 in main ()
eax	0x566802d6	1449657046
ebx	0x598f475c	1502562140
ecx	0x598fa70c	1502586636
edx	0xf7c42cc7	-138138425
esi	0xf6b2c01c	-156057572
edi	0x80000fe0	-2147479584
ebp	0xffffbab8	4294949560
esp	0xffffbaa0	4294949536
eip	0x5881bc67 <js::gc::BufferAllocator::alloc(unsigned int, bool)+247>
=> 0x5881bc67 <_ZN2js2gc15BufferAllocator5allocEjb+247>:	movl   $0x16a,0x0
   0x5881bc71 <_ZN2js2gc15BufferAllocator5allocEjb+257>:	call   0x57e21a40 <abort>

Marking s-s until checked out, since this is in GC.

Comment 1

[Christian Holler (:decoder)]

Attachment: Detailed Crash Information

Comment 2

[Christian Holler (:decoder)]

Attachment: Testcase

Comment 3

[Iain Ireland [:iain]]

Jon, this looks related to bug 1911537. Can you take a look?

Comment 4

[Bugmon [:jkratzer for issues]]

Verified bug as reproducible on mozilla-central 20250109183505-d342dabbf522.
The bug appears to have been introduced in the following build range:

Start: 0c612ed5d669c157a34c24d0c7df4b7f8ccd5fe4 (20250107174525)
End: d95fadc5b8ff50c770be155a699c1c0aa8050925 (20250107190011)
Pushlog: https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=0c612ed5d669c157a34c24d0c7df4b7f8ccd5fe4&tochange=d95fadc5b8ff50c770be155a699c1c0aa8050925

Comment 5

[Jon Coppeard (:jonco) (PTO until 14th September)]

Attachment: Bug 1940719 - Avoid overflow BufferAllocator::IsSmallAllocSize r?sfink

This is overflowing because we try and round the size in bytes up to the next
power of two in this method.

We can avoid this by checking for large allocation sizes first (which does not
require rounding up to a power of two).

This patch also adds some extra assertions to guard against overflow.

Comment 6

[BugBot [:suhaib / :marco]]

Based on comment #4, this bug contains a bisection range found by bugmon. However, the Regressed by field is still not filled.

:jonco, if possible, could you fill the Regressed by field and investigate this regression?

For more information, please visit BugBot documentation.

Comment 7

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1934856

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b6a705b6bea5
Avoid overflow BufferAllocator::IsSmallAllocSize r=sfink

Comment 9

[Donal Meehan [:dmeehan]]

https://hg.mozilla.org/mozilla-central/rev/b6a705b6bea5

Comment 10

[Bugmon [:jkratzer for issues]]

Verified bug as fixed on rev mozilla-central 20250114163033-6b0b18434da4.
Removing bugmon keyword as no further action possible. Please review the bug and re-add the keyword for further analysis.